f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33

Analysis

max time kernel
149s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe
Size 2.8MB
Sample260506-pf2daaes2n
SHA256 f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33
MD5 36f357cb5702db60eec149f48a5d078c
SHA1 42afee7e69f4ce635323664b86cb1fded3e06942
SHA512 ca9723cd5574e054bb80b843fcb3830b791c988b553009a73f695abfa5078b95aff9407d8ae87318c36e4f94ffcc0e7fcd393d68bb697788e62bf6881d153114
SSDEEP 49152:Q6hP8wz0KPQc+6siMBHayLg0AORzmOo02kf194wOLQcbTeW:aR/iMB6yLg0AORzVohkEwOJ
TLSH
T19AD58E23E142C462E1661AF062B5173D7A7847371AB8CC83BBFCDDA56F325239B9510E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4868	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe
4868	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe
4868	f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe

C:\Users\Admin\AppData\Local\Temp\f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe
"C:\Users\Admin\AppData\Local\Temp\f6dd415ad72ec2af627ad07446f432bbe14fca87547ee3b79fc12aaa6be16c33.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iext1.fnr.bbs.125.la

Path C:\Users\Admin\AppData\Local\Temp\iext1.fnr.bbs.125.la
Size 743KB
SHA256 6e0e61013defc4f0c68324a7db528c09ed9c2e929402e7231ff86d89a84275e0
MD5 ab33f0b0ea6f6e264e830d940eed9b1e
SHA1 0e2df02738b558ed830c24a4b835ab1e1bfcf33c
SHA512 2bc4a009af79dcf4a743363224219a954b38869829cc5a56d32b65ecfdd97887d7850c7d6cfc089aa83efc1986c72658e8e41986ad6958efba9f45329611da67
SSDEEP 12288:umw1/RdvNCMFaHGnLoN+v6eaWph/nQ/+ETNZRTH3PT2Y538yyq80dNOWmSD2a:umw1/PN/aHGnLCeaWz/sZTTHfT738C8C
TLSH
T1BCF49D12B94280BBE4AD00B1456F6F6F4A2D9B114BB5A9C777D41DA90F346C0BB3E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4868-5-0x00000000026A0000-0x00000000026A1000-memory.dmp

Download